CX as Code CLI export command failing with 403 on /architect/flows

Trying to dump all Architect flows to JSON for backup using the CX as Code CLI. Running cxaas export architect-flow --all but hitting a 403 Forbidden on the GET /api/v2/architect/flows endpoint. The service account has Read access to Architect, confirmed in the UI, but the CLI keeps bombing out. Is there a specific scope missing in the OAuth token generation script?